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Abstract 

We propose the use of the cubic transformation for pubhc-key ap- 
phcations and digital signatures. Transformations modulo a prime p 
or a composite n = pq, where p and q are primes, are used in such 
a fashion that each transformed value has only 3 roots that makes 
it a more efficient transformation than the squaring transformation 
of Rabin, which has 4 roots. Such a transformation, together with 
additional tag information, makes it possible to uniquely invert each 
transformed value. The method may be used for other exponents as 
well. 
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1 Introduction 

Certain many-to-one mappings, when used together with additional side in- 
formation, may be uniquely inverted and used for public-key cryptography 
and digital signatures. Given message m in Z„, we propose the use of the 
encryption function c = mod n under suitable restrictions on m and n. 
We will be primarily interested in the case where 3 divides the Euler totient 
function 4>{n), but 9 does not. 

For secure communication, Alice transmits to Bob c together with side 
information which may be sent in an encrypted form or published. 

This transformation is more efficient than the mapping c = mod n 
proposed by Michael Rabin [1] that has the virtue of being provably at most 
as intractable as the factorization of n. In his article, Rabin did consider 
generalization beyond the squaring function, but he dismissed the use of 
higher powers for their relative inefficiency. Specifically, he spoke of the 9 
cube roots in the cubic mapping, having implicitly taken n to be divisible by 



9, which made it less efficient than the squaring transformation with its four 
roots. 

The n that we choose ensures only three cube roots for each value mak- 
ing it more efficient than the squaring transformation. We also consider 
extensions of our side information scheme to the case when n is divisible by 
9. Given its easy implementation, the proposed cubic transformation lends 
itself to public key applications. Specifically, 

• It makes additional exponents available in exponentiation transforma- 
tions [2,3] and for key-distribution systems that use powers of primitive 
roots. 

• It makes it possible to use a small exponent to send information and 
implement digital signatures. 

• It allows the generation of probabihty events based on whether the 
parity of the bit chosen by the recipient is the same as the one picked 
at the sending point. 



2 The properties of the cubic transformation 

Consider first the transformation c = mod p, where p = 3A; -|- 1 is prime, 
and p — 3 mod 4. Since p — 1 and 3 have at least one common divisor (namely 
3), this transformation is not one-to-one, and because of the cubing operation 

3 different values of m map to the same c. 

If p — 1 is not divisible by 9, one can obtain one of the three values of c^^^ 
by means of an inverse exponentiation operation: 

1/3 _ f if p — 1 mod 9 = 6 , . 

C ' — \ 2p+l (Ij 

[ c 9 if p — 1 mod 9 = 3 

The proof of this assertion is in the fact that c^~^ = 1 by Fermat's Little 
Theorem and c"'^p-^)+^ = c^. Consequently, c 9 = c^^^. If p — 1 mod 9 = 
6, then p -|- 2 is divisible by 9; if p — 1 mod 9 = 3, then 2 (p — 1) -|- 3 is divisible 
by 9. 

An inverse cannot be obtained by exponentiation if p — 1 is divisible by 

9. 
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The cube roots of 1 are 1, a and because if a is a root, so is its square. 
This imphes that if one of the cube roots of c is m, the others must be ma 
and mo? . 

The three cube roots of 1 may be obtained by solving the equation: 

- 1 = (2) 

Apart from the obvious solution of 1, the other two solutions are obtained 
by solving q;^ + q; + 1 = 0, which is possible if the square root of sjp — 3 exists. 
This may be determined by the use of Euler's criterion that h is square modulo 
p if and only if 

^(p-l)/2 ^ p 

Since p — 3 mod 4, the square root a^/^ — , and we can write, 

« = =i^#^ = i(-l±(p-3)'J^) (3) 

Since the two roots can also be written as a and a^, the value of a may be 
equivalently expressed as: 

-l-(p-3)'J^ 

If the square root of (p — 3) does not exist, one must use a probabilistic 
method to determine a. 

Note that 1 + a + = mod p. This follows from the fact that (1 + a + 
Q/2)3 _ I ^jjjg means that the value of may be obtained by subtraction. 

The complexity of this computation is no more than that of exponentia- 
tion. 

Example 1. Consider c — m^ mod 31. 

To compute a, we must first find ^/—3 = This can be reduced 

by using the transformation 28^^ = 28^ which is equal to 20. Therefore, 
a = —21/2, 19/2, which may be reduced to 5 and 25. The cube roots of 1 
are, therefore, 1, 5, 25. We may pick one of these, say 5, as a. 

Let Alice choose m — 7. She computes m, ma, ma'^, which are 4, 20, 7. 
Rearranging them in order, she gets 4, 7, 20 that correspond to the ranks 1, 
2,3, and thus the side information related to her choice of m is 2. 
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Alice sends c = 7^ mod 31 = 2, together with the rank information of 2 
(that is either pubhshed or sent in an encrypted form separately) to Bob. 
Using equation (1), Bob finds that one of its cube roots is 2''' mod 31 = 4. 
The other cube roots will be 4 x 5 = 20 mod 31, and 20 x 5 = 7 mod 31. 
The side information then helps him pick m = 7 as the message sent by 
Alice. 



Table 1: Mapping for p = 31, a = 5 



Values of m, ma, ma'^ 


The output c 


1, 5, 25 


1 


2, 10, 19 


8 


3, 15, 13 


27 


4, 20, 7 


2 


6, 30, 26 


30 


8, 9, 14 


16 


11, 24, 27 


29 


12, 29, 21 


23 


16, 18, 28 


4 


17, 23, 22 


15 



3 Cubic transformation modulo a composite 
number 

We now consider the cubic transformation modulo n = pq, where 0(n) = 
(p — l){q — 1) is divisible by 3 but not 9. Then the inverse is given by: 

1/3 _ J if (/>(n) mod 9 = 6 , . 




if (j)[n) mod 9 = 3 

The method of inverse transformation is identical to that in the previous 
section, excepting that under certain circumstances the computation of a 
will require solving equation (2) modulo the two prime factors of n and then 
combining them to get the answer modulo n. Both Alice and Bob know the 
factors of n, but the eavesdropper does not. 

Example 2. Consider c = mod 77; p = 7, q = 11. To find the value of 
a by the method of equation (3), we must obtain ^/p — 3 = \/74. But 74 is 
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not square modulo 77, therefore, we find the solution directly by the Chinese 
Remainder Theorem (CRT), by solving: 

separately for the two moduli 7 and 11. We can try to obtain these solutions 
using the method of equation (3). Note that only one new solution is required 
to fix a and, therefore, it is not essential that solutions to both the primes 
are found. 

For p=7, p — 3 = 4 is square modulo 7, and, therefore, the solutions are 
easily obtained: 

dip = 2,4 

But 8 is not square modulo 11, therefore, equation (3) cannot be used for 
it. We, therefore, merely use the obvious solution: 

1 

Combining, using the CRT, 

a — ap X q X \ \q~^\\p + ag x p x mod pgr (6) 

where | \x\ \y = x mod y. 

Since mod 11 = 8, and 11~^ mod 7 = 2, we have: 

cti = 2 X 11 X 2 + 1 X 7 X 8 = 100 = 23 mod 77 
as the first value, and 

as = 4 X 11 X 2 + 1 X 7 X 8 = 144 = 67 mod 77 

as the second value. 

It is assumed that Alice and Bob have chosen in advance to use a = 23 
for their communications. 

Consider the message Alice wishes to send is m = 12. As in the previous 
case, she finds its companions by multiplying it successively by a = 23, thus 
obtaining 34, and 45. The rank order of her message is 1. 

She now performs the cubic transformation on her message 12, sending 
Bob c = 34 together with the side information of 1. 
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Bob find its three cube roots by first calculating c^^^ = = 34^ = 34. 
The other cube roots are: 

34 X 23 = 12 mod 77 

and 

34 X 67 = 45 mod 77 

Bob knows that the message was one of the three 12, 34, and 45. The 
side information tells him that the specific message out of this set is 12. 
Since there are three solutions, the side information will require 2 bits. 

4 (/)(n) divisible by 9 

The method proposed will actually work even for 0(n) that is divisible by 
9. Although each number will now have 9 cube roots, they may be bunched 
together in separate groups in a variety of ways. 

The 9 cube roots of 1 may be obtained by solving 

a^-l = Q (7) 

which may be simplified to: 

(q;-1)(q;^ + q; + 1)(q;^ + q;^ + 1) = (8) 

Let the cube roots of 1 be put in numerical order and labeled 1 through 
9. Alice would take the message she wishes to send to Bob and find all the 
multiples of it with the cube roots of 1, and find its relative position in the 
set. Then she will send the original message with this position number as 
side information. 

Bob will obtain the cube root of c and then list all its companion solutions. 
Given the position number, he will then be able to determine its value. 

Example 3. Consider c = rn? mod 91, where 4>{n) = 72. Since 88 is square 
modulo 91, one can use equation (3) to determine the cube roots of 1 modulo 
91, and a simple calculation gives us the values 9 and 81. Since 9 and 81 
are not cubes themselves, we cannot use equation (8) to find the remaining 
cube roots. Additional cube roots of 1 are obtained by solving the equation 
— 1 = for the two moduli 7 and 13 (4 and 10 are square modulo 7 and 
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13, respectively) and using CRT to combine the results. We end up with the 
following 9 cube roots of 1: 1, 9, 16, 22, 29, 53, 74, 79, 81. 

Assume Alice wishes to send the message 24 (which is relatively prime 
to 91, and therefore it has 9 cube roots) to Bob. She finds the multiples of 
24 with the cube roots of 1, and obtains the set: 20, 24, 33, 34, 47, 59, 73, 
76, and 89. The sequence number of 24 is 2, and this number is sent as side 
information, together with 24^ = 83. 

Bob first finds the cube root of 83 by the use of CRT or some probabilistic 
algorithm. Suppose, this number is 33. Now he computes the multiples of 
33 with all the cube roots of 1, obtaining: 33, 24, 73, 89, 47, 20, 76, 59, 34. 
Since the side information has revealed that the message has the second rank 
in this set, he now knows that it is 24. 

Probability events 

The 9 cube roots of 1 may be written as numbers and their squares: 

1, a, b, c, d, a^, 6^, c^, (9) 

These may be bunched together in 3 groups. Alternatively, if it is agreed 
by Alice and Bob that each group of three have 1 in it, these numbers may 
be put in four groups in the following manner: 

l,a,a^; 1,6,6^; l,c,c^; l,d,d'^ (10) 

Thus, in our example, the four sets will be: 

1,9,81; 1,16,74; 1,22,29; 1,53,79 

Let the protocol require that Bob pick one of these four sets. Bob is 
also told the rank order within each subgroup. His chances of obtaining the 
correct message are |. 

It is clear that the groupings could be done differently as well. But 
whichever way the groupings are done, they are incorporated in the protocol 
of the communicating parties. 
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5 Generalizations 



Generalizations of this method to higher exponents may be readily made. 

The method of tags may also be applied to the squaring transformation. 
Once a square roots o; of 1 (other than 1 or n — 1) is known, the full set of 
solutions follows: 

l,a,n — l,n — a 

One needs 2 bits of side information to uniquely identify the message m 
that gave rise to the received c. 

For /cth-roots of 1 related to the solution to c = mod n, k odd, the 
number of groups to generate probability events in the manner of equation 
(10) will he k + 1, that is \Er^ corresponding to the probability of 

Random number generation 

The cubic transformation may also be used to generate random numbers Si 
in a manner analogous to the squaring transformation [4]. Let sq be the 
seed and let n = pq for primes p, q, where (f){n) is divisible by 9, and sq is 
relatively prime to n, then, 

S'i = (sj-i)^ mod n (11) 

The condition of divisibility of 0(n) by 9 is to increase the computational bur- 
den of inverting the transformation. The tree of possibilities has 9 branches 
at each step. 

For a cryptographically strong random number generator to radix-r that 
generates the sequence Cj, one may reduce the numbers Si to the modulus r, 
where r < n: 

Ci = Si mod r (12) 
For binary random numbers generated by this equation, r will be 2. 
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